Nginx 点滴

目录

虚拟机：

微服务转发：

资源跨域:

限流设置：

参考：

---

虚拟机：

server {
        listen       80;
        listen       [::]:80;
        server_name  book.gdtwzc.com;
        
        set $host_path "/var/www/html/Supports/BookStack/public";
        
        listen       443 ssl;
        ssl_certificate /var/server-auths/certs/$server_name/fullchain.crt;
        ssl_certificate_key /var/server-auths/certs/$server_name/the.key;

        access_log   /var/log/nginx/book.log main;
        error_log    /var/log/nginx/book.error.log;
        
        charset utf-8;
        
        root   $host_path;
        index  index.html index.htm index.php;

        location /.well-known/acme-challenge/ {
            alias       $host_path/.well-known/acme-challenge/;
            try_files   $uri =404;
        }
        
        location / {   
            try_files $uri $uri/ /index.php$is_args$args;
        }
        
        location ~ \.php$ {
            try_files $uri =404;
            #fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
            fastcgi_pass php8:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;
        }
        
        location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
          expires 30d;
          access_log off;
        }
        
        location ~ .*\.(js|css)?$ {
          expires 7d;
          access_log off;
        }
        
        location ~ /\.ht {
          deny all;
        }
     
        #include agent_deny.def;
}

微服务转发：

server {
        listen       80;
        listen       [::]:80;
        server_name  ai-chat01.gdtwzc.com;

        #if ($host != 'ai-chat01.gdtwzc.com') {
        #  rewrite ^/(.*)$ https://ai-chat01.gdtwzc.com/$1 permanent;
        #}

        listen       443 ssl;
        ssl_certificate /var/server-auths/certs/$server_name/fullchain.crt;
        ssl_certificate_key /var/server-auths/certs/$server_name/the.key;
        
        #large_client_header_buffers 4 32k;

        access_log   /var/log/nginx/ai-chat01.gdtwzc.com.log main;
        error_log    /var/log/nginx/ai-chat01.gdtwzc.com.error.log;
        
        charset utf-8;
                
        location /.well-known/acme-challenge/ {
            alias       /var/www/html/Research/one-api/.well-known/acme-challenge/;
            try_files   $uri =404;
        }
        
        location / {
          auth_basic  "Authorize Site";
          auth_basic_user_file /var/server-auths/htpasswd;
            
          proxy_pass http://172.17.0.149:3000;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
        }

     
        #include agent_deny.def;
}

资源跨域:

法一：CORS（Cross-Origin Resource Sharing) 服务器支持

location / {
  add_header Access-Control-Allow-Origin *;
  add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
  add_header Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept";
  if ($request_method = 'OPTIONS') {
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
    add_header Access-Control-Allow-Headers "Origin, X-Requested-With, Content-Type, Accept";
    return 200;
  }
}

法二：服务器代理访问 

server {

    #nginx监听所有localhost:8080端口收到的请求
	listen       8080;
	server_name  localhost;

	# Load configuration files for the default server block.
	include /etc/nginx/default.d/*.conf;

    #localhost:8080 会被转发到这里
	#同时, 后端程序会接收到 "192.168.25.20:8088"这样的请求url
	location / {
		proxy_pass http://192.168.25.20:8088;
	}

	#localhost:8080/api/ 会被转发到这里
    #同时, 后端程序会接收到 "192.168.25.20:9000/api/"这样的请求url
	location /api/ {
		proxy_pass http://192.168.25.20:9000;
	}

	error_page 404 /404.html;
		location = /40x.html {
	}

	error_page 500 502 503 504 /50x.html;
		location = /50x.html {
	}
}

限流设置：

编辑 nginx.conf

http {
    limit_rate 250k;  # 单个请求带宽
    limit_conn_zone $binary_remote_addr zone=addr:10m; # 连接限制域
    limit_req_zone $binary_remote_addr zone=one:10m rate=20r/s;  # 单个ip请求限制速率

...

编辑 虚拟机文件 uat.conf

location ~ \.php$ {
          #limit
          limit_conn addr 50;  #单ip限制50个connections
          limit_req zone=one burst=5;  # 应用请求限制

...

参考：

- Module ngx_http_limit_conn_module

- NGINX Rate Limiting

- Nginx限流模块limit_req_zone死磕之路 - Darren-Blog

- Nginx访问限制模块limit_conn_zone 和limit_req_zone配置使用 - PengYunjing - 博客园